Apple + Security & Privacy

Not long after a team of researchers discovered that FileVault encryption has a weakness, on of the researchers on that team has shown that Mac OS X account passwords suffer from a similar vulnerability. As reported by CNet, Jason Applebaum has found that account passwords remain in memory longer than necessary, opening them up to discovery if someone has physical access to a Mac. Apple has confirmed the bug, and has not specified when they will be addressing it.

The vulnerability requires both physical access to a Mac and special software, which scans the contents of the Mac’s memory and discovers what the user’s password is. Applebaum demonstrated this for a CNet journalist who had set up a Mac for a test. It only took a few minutes for Applebaum to find the password.

While this glitch is serious, and needs to be addressed, another weakness exists with Mac OS X: anyone with an installation disc can boot any Mac from that disc and reset the administrator’s password. It’s hard to say which is easier, but it seems that using a DVD, and avoiding the need for home-built software, would be the first choice for most hackers. Physical access is one of the weak links in Mac security, so if you need to protect especially sensitive files, you should use a program like Intego FileGuard, which uses virtual safes with unique passwords to protect your most confidential files.